mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 16:47:20 +09:00
IvanHunters
559c050de0
Conformance review against the design proposals surfaced that a short-name tap ignored the index entry's recorded version: resolveTapTarget returned the bare ociRef, so 'cozypkg tap <name>' pulled :latest while the CI gate had validated and cosign-verified <ociRef>:<version>. The gate signed one tag and the cluster pulled another, breaking both the versioning model (#18) and the signature chain (#23). Resolve the short name to <ociRef>:<version> when a version is recorded. Also harden the publication gate: run 'cozypkg validate --helm-lint' (with helm installed in the workflow) so charts are linted as the design specifies, and add a CODEOWNERS so every index entry requires maintainer review. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
9 lines
389 B
Plaintext
9 lines
389 B
Plaintext
# Every index entry requires maintainer review before merge (the auto-merge
|
|
# lane in validate.yaml only fires for an owner version bump signed by the
|
|
# entry's recorded identity; everything else lands here).
|
|
/entries/ @cozystack/maintainers
|
|
|
|
# The gate itself and the workflow are maintainer-owned.
|
|
/scripts/ @cozystack/maintainers
|
|
/github-workflows/ @cozystack/maintainers
|